Securing the Perimeter - CFCR/CFAR Chain of Custody With CI/CD Pipelines
summary
Describes a concrete CI/CD hardening checklist for CFCR/CFAR and Kubernetes: sign git commits and Docker images with Notary/TUF, enable Docker Content Trust, enforce TLS/mTLS and IP whitelisting between pipeline stages, rotate developer keys (example cadence suggested every 30 days), and repave stemcells frequently (example policy: 24‑hour repave) with automated canary updates. Covers runtime controls (namespaces, read‑only rootfs, seccomp/AppArmor), artifact hash verification, and using an artifact registry (Harbor/registry + notary) to prevent pipeline-to-production compromise.
AI-written summary · about
chapters (9)
- 0:00Start
- 5:31Shift the Mindset
- 6:18A Standard Delivery Pipeline
- 8:00Defending the Supply Chain Threat
- 13:08Limiting CI/CD Breakout Exposure
- 14:08Defending the Application Integrity
- 15:35So What Happens During The Push?
- 25:44Bringing it all together
- 27:02Conclusion-Move The Target
related talks
24mProtecting Ourselves from CNCFgate. Software Supply Cha...
38mSecuring your CI/CD Pipeline
10mIt's Time We Start Securing Our CICD Pipelines
33mSecuring Your Infrastructure as Code Pipeline
24mDon’t be a fail whale, secure your containers
26mProtect the Pipe! A Policy-based Approach for Securing CI/CD Pipe...
43mThe art of secure software: Zero-trust delivery pipelines
05mContainer Security Best Practices